Home > Articles > Security > Network Security

Is My Computer a Zombie? (and Other Uses for Netstat)

  • Print
  • + Share This
Netstat is a helpful tool for displaying information about current network connections. In this article, Kyle Cassidy and Richard Cardona give you the scoop on Netstat syntax and uses.

Netstat (NETwork STATe) is an old part of the TCP/IP suite of tools. It's mentioned as far back as 1972, when it was known also as "who is up." Netstat is used to display not completely related information about current network connections. It has many implementations, from Unix to Microsoft Windows, each carrying a subset of the netstat commands.

Netstat is defined in RFC 1147, "The Internet Tool Catalog," as follows:

...a program that accesses network related data structures within the kernel, then provides an ASCII format at the terminal. Netstat can provide reports on the routing table, TCP connections, TCP and UDP "listens," and protocol memory management. MECHANISM Netstat accesses operating system memory to read the kernel routing tables.

Netstat provides this information for the moment at which one executes the command. That information might change even as netstat is running.

Netstat Commands and Syntax

Netstat works from a command line and has a variety of switches, as shown in Table 1.

Table 1 Netstat Command Switches


Displays all connections and listening ports.


Displays Ethernet statistics. May be combined with -s.


Displays addresses and port numbers in numerical form.

-p proto

Displays connections for the protocol specified by proto; proto may be TCP or UDP. If used with the -s option to display per-protocol statistics, proto may be TCP, UDP, or IP.


Displays the routing table.


Displays per-protocol statistics. By default, statistics are shown for TCP, UDP, and IP; The -p option may be used to specify a subset of the default.


Redisplays selected statistics, pausing interval seconds between each display. Press Ctrl+C to stop redisplaying statistics. If omitted, netstat will print the current configuration information once.

Obviously, you can use the command

netstat /?

from a Microsoft DOS window to get the command set, or you can use the command

man netstat

from a Unix system.

The netstat command is used to obtain information about the current STATe of the NETwork by displaying current network connections.

  • + Share This
  • 🔖 Save To Your Account

Related Resources

There are currently no related titles. Please check back later.